Minimal, reproducible example

const puppeteer = require('puppeteer');

(async () => {
  const browser = await puppeteer.launch({ headless: true });
  const page = await browser.newPage();
  await page.goto('about:blank');

  const result = await page.evaluate(() => {
    return Object.getOwnPropertyNames(document).includes('createElement');
  });
  console.log(result); // Should log: false, but it shows true

  await browser.close();
})();

Error string

no error

Bug behavior

• Flaky

  PDF
  To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.

Background

document.createElement is an indicator of Puppeteer usage. This knowledge allows protected sites (e.g., Cloudflare: berstend/puppeteer-extra#832) to deny access not only to bots using Puppeteer but also to people who create a browser instance through Puppeteer.

A long time ago, this issue was already described, but it was ignored: #7402. Now, I want to revive the discussion on this topic. Solving it could potentially address access issues to a large number of resources.

Expectation

document.createElement should be a function exactly as described in the DOM Standard

Reality

document.createElement is now a proxy function, which is functionally no different from a normal function, but its use affects client security

Puppeteer configuration file (if used)

No response

Puppeteer version

22.11.0

Node version

18.16.1

Package manager

npm

Package manager version

9.5.1

Operating system

Windows